That kind of bug report is bound to get a very quick triage, followed by a very quick escalation.
But yes, even with that in mind: a 4-hour turnaround is damn impressive.
Obviously not all companies behave this way, but they should!
I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.
Did they notify users whose data were compromised ?
That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...
Facebook was providing:
Cardholder Name
First 6
Last 4
Expiry Date
Billing Address.
Yes, first 6 and last 4 are not considered sensitive for PCI compliance. However, like most security standards, the standard is a minimum, not what your target should be.
Given the ability for attackers to quickly guess CVV and the remaining digits[1], the attack becomes a numbers game. They don't care about _a_ card, they care about _any_ card.
This is why Visa and MasterCard are pushing to tokenize all cards - so the stored information is linked to the merchant storing it and can't be reused.
That's even before we take into account the account take over possibilities since those card details are used by other companies as verification for account recovery[2]. Yes, those vulnerabilities were closed, but that doesn't stop new companies from making the same mistakes.
Yes, it's impressive that they managed to prune the fields so quickly. Shows a very efficient escalation path!
[1] https://www.theregister.co.uk/2016/12/05/undetectable_sixsec...
[2] https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...
Kudos to facebook team that they responded shortly, I cannot tell if it was work hours or not, but either way, this is very very short in the context of large corporations.
Most likely a single dedicated person at FB.
Even if the fix was done by one "dedicated employee" , they still belong to a team of people working together. I feel like singling out one person like this is almost rude to the rest of the team.
So if somehow their graph api has pulled up my credit card number into their database, that's the disturbing thing...
Advertisement is Facebook's #1 revenue model, its literally why they exist. I wish everyone who's used FB would sign up for a business page and place an ad; it's illuminating to see just how detailed their tools are.
Same with Google PPC and Bing etc etc.
I shudder to think at just how detailed the profiles are that FB, AMZN et al keep on each of its users.
It's how they exist, not why.
I do agree that their data collection is very creepy.
I believe they also used to have a system (maybe they still do?) where you could buy "Facebook Credits" to use on Facebook platform games, essentially microtransactions.
`CSPlaygroundGraphQLFriendsQuery` is a demonstration for Facebook engineers internally to show how to display a list of "oneself's friends with auto-pagination" using GraphQL and ComponentScript inside their Facebook main app
P.S. I don't work at Facebook. But this is something I stumbled across their app.